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Abstract 

Decoy states have recently been proposed as a useful method for substantially improving the 
performance of quantum key distribution protocols when a coherent state source is used. Previously, 



> 

O 

\^ , data post-processing schemes based on one-way classical communications were considered for use 



with decoy states. In this paper, we develop two data post-processing schemes for the decoy-state 
method using two-way classical communications. Our numerical simulation (using parameters 
from a specific QKD experiment as an example) results show that our scheme is able to extend 



qh| the maximal secure distance from 142km (using only one-way classical communications with decoy 



states) to 181km. The second scheme is able to achieve a 10% greater key generation rate in the 
whole regime of distances. 
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I. INTRODUCTION 

Quantum key distribution (QKD) allows two users, commonly called Alice (sender) and 
Bob (receiver), to communicate in absolute security in the presence of an eavesdropper. Eve. 
Unlike classical cryptography, the security of QKD is based on the fundamental principles 
of quantum mechanics, rather than unproven computational assumptions. 

The best-known QKD protocol — the BB84 scheme — was published in 1984 \^. In BB84, 
Alice sends Bob a sequence of single photons each of which is randomly prepared in one of 
two conjugate bases. Bob measures each photon randomly in one of two conjugate bases. 
Alice and Bob then publicly compare the bases and keep only those results (bits) for which 
they have used the same bases. They randomly test a subset of those bits and determine 
the quantum bit error rate (QBER). If the QBER is larger than some prescribed value, 
they abort the protocol. Otherwise, they proceed to the classical data post-processing 
(which consists of error correction and privacy amplification) and generate a secure key. 
The .ecunty of BB84 ha. been rigorously proven in a number ot paper. flBQ, see abo Q. 

The security proof in |j| shows that the BB84 protocol can be successively reduced from 
a entanglement distillation protocol (EDP). This idea is relevant to this paper since our data 
)ost-processing schemes are based on EDPs. We remark that EDPs were first discussed in 
6|, that its relevance to the security of QKD was emphasized in [7|, and that this connection 
was established rigorously in [3|. The EDPs proposed earlier use local operations and one- 
way classical communications (1-LOCC). Later, Gottesman and Lo provided security proofs 
of standard quantum key distribution schemes by using a EDP with local operations and 
two-way classical communications (2-LOCC) 8]. They showed that BB84 using 2-LOCC 
can tolerate a higher bit error rate than 1-LOCC (see also [9|). On the other hand, Gerd, 
Vollbrecht and Verstraete also proposed another EDP that uses a 2-LOCC based recurrence 



scheme 



id ]. Although their scheme was originally proposed as an EDP, we will use it here in 



a QKD to increase the key generation rate. [It should be noted that the EDP approach is only 



approaches to security 



one of the several approaches to security proofs of QKD. Other usefu 
)roof can be based on, for example, communication complexity ll|, quantum memory 
12,|l3|, or direct information-theoretic argument |15|.] Recently, it has been demonstrated 
14| rigorously that one can generate a long secure key even when the amount of distillable 

entanglement in a quantum state is arbitrarily small. In other words, secure key generation 



is strictly weaker than entanglement distillation. Recently, the universal composability of 
quantum key distribution has been proven in |lq . 

In summary, QKD is secure in theory. Much of the interest in QKD is due to its po- 
tential in near-term real-life applications. Indeed, commercial optical-fiber-based quantum 
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cryptographic products are already on the market ^ ^ 

Meanwhile, experimentalists have done many QKD experiments, such as [l8[ and [l9|,|20|. 
The key issue in QKD experiments is whether they are really secure. Standard security 
proofs are often based on perfect devices, such as perfect single photon sources. All devices 
are imperfect in real implementations, such as imperfect single photon sources and highly 
lossy channels. It is thus important to study the security of QKD with imperfect devices. 



Substantial progress has been made in the sub 



ect |21, 



2% 



u 



23|. 



Unfortunately, with the method in GLLP 22^, QKD can only be proven to be secure 
at very limited key generation rates and distances. It came as a big surprise that a simple 
solution to the problem — the decoy state method — actually exists. The decoy method was 
first discovered by Hwang [2J| , and made rigorous by our group [2^ |2^ , and also J22l, |2^ . In 
addition, our group demonstrated the first experimental implementation of a QKD protocol 
using one decoy state 29|. 

decoy state protocols over non-decoy-state protocols have previously 
26l . within the context of 1-LOCCs, for an iniperfect source. Since 
2-LOCa a. k™ to be .peno. to 1-LOCCs fo. a perfect .ou.ce faQ, . wo.,d be 
interesting to study the usefulness of decoy state protocols with 2-LOCCs, for an imperfect 
source. This is the main goal of this paper. Indeed, as we will show, decoy state protocols 
with 2-LOCCs are superior to decoy state protocols with only 1-LOCCs in realistic situations. 
Specifically, in this paper, we develop two data post-processing schemes for the decoy method 



The usefulness o 
been demonstrated 



oL25l 
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25l|26| by applying two 2-LOCC EDPs, Gottesman-Lo EDP [8| and the recurrence scheme 
. Both methods are superior to the random hashing 1-LOCC EDP (for the rest of the 
paper, we will simply call it as the 1-LOCC EDP) in two different aspects in the case of 
ideal devices; the Gottesman-Lo EDP was shown to be able to achieve a higher tolerable 
bit error rate, while the recurrence method was shown to be able to achieve a higher key 
generation rate. We will show in this paper that the same conclusion holds in the case of 
imperfect devices. In particular, depending on the distance in a QKD experiment, one can 
use our Gottesman-Lo EDP based data post-processing scheme in the long distance region 



or our recurrence based data post-processing scheme in the short distance region to increase 
the key generation rate. 

We note that a recent and independent analysis of combining B steps with GLLP and 
decoy states is given in J30|. Their data post-processing scheme is the same as our first 
scheme, which is aimed at increasing the maximal secure distance. On the other hand, in 
this paper, we also propose the second scheme, which is aimed at increasing the key rate at 
short distances. 

The organization of this paper is as follows: We first review entanglement distillation in 
Section inland some existing techniques for realistic QKD in Section UTTl We then investigate 
the tolerable error rates, the upper bounds of secure distance and key generation rate in 
Section IIVI Sections El and EH contain the main results of the paper. Specifically, we 
develop two data post-processing schemes, one with the B steps from Gottesman and Lo 8| 
(see Section E|), and the other with recurrence (see Section EH)- Our simulation (based on 
the GYS experiment jl2|) shows that with B steps from Gottesman-Lo EDP, the maximal 
secure distance can be extended to 180km compared with 140km with 1-LOCC, and the 
key generation rate increased by more than 10% in the whole regime of distances. With our 
QKD model, we also consider statistical fluctuations on the estimated parameters when the 
data has finite length (see Section rvil|) . The result shows that the B step can extend the 
maximal secure distance and the recurrence can raise the key generation rate. Although, 
in this paper, we focus on the BB84 protocol, our schemes can be applied to other QKD 
protocols as well. 

II. REVIEW OF ENTANGLEMENT DISTILLATION 

In this section, we review Shor-Preskill's security proof of QKD and two EDPs based 
on 2-LOCC (Gottesman-Lo EDP and recurrence EDP) assuming that ideal single-photon 
sources are used. In Sections IVl and IVTl we generalize these two schemes for realistic setups. 

The idea of the Shor-Preskill |J] security proof of QKD is to apply an EDP to show that 
the leaked information about the final key is negligible. Here we will explain how to analyze 
the security of EDP-based QKD. 



In the EDP-based QKD protocol, Alice creates n + m pairs of qubits, each in the state 

1 



V2 



(|00) + |11)), 



the eigenstate with eigenvalue 1 of the two commuting operators X ^ X and Z ^ Z, where 



X 



1 

1 




are the Pauli operators. Then she sends half of each pair to Bob. Alice and Bob sacrifice m 
randomly selected pairs to test the error rates in the X and Z bases by measuring X ^ X 
and Z ^ Z. If the error rates are too high, they abort the protocol. Otherwise, they conduct 
the EDP, extracting k high-fidelity pairs from the n noisy pairs. Finally, Alice and Bob both 
measure Z on each of these pairs, producing a k-bit shared random key about which Eve has 
negligible information. The protocol is secure because the EDP removes Eve's entanglement 
with the pairs, leaving her negligible knowledge about the outcome of the measurements by 
Alice and Bob. 

In the EDP, after the qubits' transmission, Alice and Bob will share the state with density 
matrix, 

/goo X X X \ 

X gio X X 

X X gii X 

^ X X X goi/ 

normalized with goo + ?io + Qu + ?oi = 1- Here x's denote arbitrary numbers, all of which 
are not necessary the same, and the density matrix is in the Bell basis: 
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(1) 



l^oo) 



V2 



(|00) + |11)) 



|z^io) = ^(|01) + |10)) 



iV^ii) 



V2 



(|01)-|10)) 



|^oi) = ^(|00)-|ll)). 

Since all EDPs we consider in this paper do not make use of the off-diagonal elements in 
Eq. (^ to extract entanglement, it is sufficient to characterize the density matrix by only 
the diagonal elements (goo, gio, ^ii, %i)- Iii fact, any shared state can always be transformed 



m- 



into a diagonal form by local operations and classical communications [33[. The density 
matrix is now a classical mixture of the Bell states ipij with probabilities qij. Therefore, the 
bit and phase error rates are given by 

5b = gio + gii 

(2) 
Sp = gii + qoi- 

A QKD protocol based on a Calderbank-Shor-Steane (CSS) 3l| EDP can be reduced to 
a "prepare-and-measure" protocol (BB84) [4]. That is to say, CSS codes correct bit errors 
and phase errors separately, which respectively turn out to be the bit error correction and 



privacy amplification in the context of QKD 



OK 



U-i 



data post-processing scheme is given by j^ 



32 



Thus the key rate of this 1-LOCC based 



Rcss = q[l-H2i5b)-H2i5p)], (3) 

where q depends on the implementation (1/2 for the BB84 protocol, because half the time 
Alice and Bob bases are not compatible, and if we use the efficient BB84 protocol 47], we 
can have q ~ 1.), Sf, and 6p are the bit flip error rate and the phase flip error rate, and H2{x) 
is the binary entropy function, 

H2{x) = -xlog2(x) - (1 - x) log2(l - x). 

In summary, there are two main parts of EDP, bit flip error correction (for error cor- 
rection) and phase flip error correction (for privacy ampliflcation). These two steps can be 
understood as follows. First Alice and Bob apply error correction, after which they share 
the same key strings but Eve may still keep some information about the key. Alice and 
Bob then perform the privacy ampliflcation to expunge Eve's information from the key. We 
remark that the key generation rate achieved by Eq. requires only 1-LOCC. 

A. Gottesman-Lo EDP 

Gottesman and Lo 8] introduced an EDP based on 2-LOCC for use with QKD and 
showed the it can tolerate a higher bit error rate than 1-LOCC based EDP's. B and P steps 
are two primitives in the Gottesman-Lo EDP, and the EDP consists of executing a sequence 
of B and/or P steps, followed by random hashing. The random hashing part is a one-way 



EDP. The main objective for extra B and P steps is reduce the bit and/or phase error rates 
of qubits so that the random hashing can work to extract secure keys. This is the reason 
why the Gottesman-Lo EDP is able to tolerate a higher initial bit error rate than one-way 
EDPs. The definitions of B and P steps are as follows. 

Definition of B step SJ: (Figure^) After randomly permuting all the EPR pairs, Alice 
and Bob perform a bilateral XOR (BXOR) between pairs of EPR pairs and measure the 
target qubits in Z basis. This effectively measures the operator Z ^ Z for each of Alice 
and Bob, and detects the presence of a single bit flip error. If Alice and Bob's measurement 
outcomes disagree, they discard the remaining EPR pair, otherwise, they keep the control 
qubit. 



1 



<B 



Measure 



FIG. 1: Alice and Bob choose two half EPR pairs and input the quantum circuit as shown above. 
They discard both control and target qubits if they disagree on the outcome of measurement on 
the target qubits. On the other hand, they keep the control qubits as surviving qubits if their 
measurement outcomes agree. 



Since the B step only involves the measurement oi Z ^ Z, it can be used in the prepare- 
and-measure protocol, BB84. Classically, the B step simply involves random pairing of the 
key bits, say xi, X2 on Alice's side and yi, ?/2 on Bob's side and the computation of the parity 
of each pair of bits, Xi © X2 and yi®y2- Both Alice and Bob announce the parities. If their 
parities are the same, they keep xi and yi; otherwise, they discard xi, X2, yi and ?/2- We 
can see that the B step is very simple to implement in data post-processing. 

Suppose Ahce and Bob input: a control qubit {<loo,(lio,(lii,<loi) and a target qubit 
(Q'oo) ?io; Q'n; Q'oi) with bit error rates 6^' and 6p' and phase error rates 6'[ and 6p, respec- 
tively. After one B step, the survival probability ps is given by. 



PS = (go'o + %'i)(%'o + Qoi) + (?fo + ?n)(9?o + Qu) 



(4) 



and the density matrix (^qq, g^Q, q[^, Qq^) of output control qubit is given by 

9oo 



Q'ooQ'oo + Q'oiQ'oi 



Ps 
/ _ gfogfo + gn9n 

Ps /c^ 

C T , C T ^ ' 

, _ QMii + gfigio 
yii — 

%1 — 



Ps 

II of y. 



Eqs. (jHI) can be derived from TABLE 

phase error rate 6p can be obtained from Eq. (0) by 



The corresponding bit error rate Sb and 



b "6 



Ps (6) 

S'p = Qn + I'oi- 

Definition of P step |8| : Randomly permute all the EPR pairs. Afterwards, group the 
EPR pairs into sets of three, and measure X1X2 and X1X3 on each set (for both Alice and 
Bob). This can be done (for instance) by performing a Hadamard transform, two bilateral 
XORs, measurement of the last two EPR pairs, and a final Hadamard transform. If Alice 
and Bob disagree on one measurement. Bob concludes the phase error was probably on one 
of the EPR pairs which was measured and does nothing; if both measurements disagree for 
Alice and Bob, Bob assumes the phase error was on the surviving EPR pair and corrects it 
by performing a Z operation. 

Without a quantum computer, Alice and Bob are not able to perform the P steps, so the 
EDP cannot depend on the results of P steps. When the P step is implemented classically 
in BB84, the phase errors are not detected or corrected (i.e. the phase flip operation Z is 
not applied). The P step then will be reduced to: Alice and Bob randomly form trios of 
the remaining qubits and compute the parity of each trio, say xi © X2 © x^ by Alice and 
2/1 ©1/2 ©2/3 by Bob. They now regard those parities as their new bits for further processing. 

Since before P steps, Alice and Bob will do random permutation, for simplicity, we assume 
the input three qubits have the same density matrix: {qoo,(lio,(lii,%i)- After one P step. 



the density matrix (^qq, g^Q, q[^, Qq^) of the output qubit is given by 

?oo = ?oo + Sgoo^oi + 3gio(?oo + ^oi) + 6googiogii 

?io = 5io + 3g?o?ii + 3goo(?io + ?ii) + Qqooqioqoi 

(7) 

^11 = 5ii + Sgiogn + 3goi(?io + qu) + Qqooqnqoi 
q'oi = qoi + Sgoogoi + 3gn(goo + qoi) + Qqwqnqoi, 

which is given in Appendix C of ^]. So the bit error rate and phase error rate will given by 

K = q'lo + q'u = 3^5(1 - 6,)' + 5! 

S', = q'u + q'o, = 36l{l-6,) + 6l. 

Here we emphasize that the B and P steps are important elements of the Gottesman-Lo 
ED P. After B and P steps, the Gottesman-Lo EDP will be the same as the regular 1-LOCC 
EDP. 

B. Recurrence EDP scheme 

Here we review another two-way EDP, the recurrence scheme [lO|. Similar to the B step 
in Gotttesman-Lo EDP, the recurrence scheme reduces the bit error rate of the EPR pairs 
before passing them to the 1-LOCC based random hashing for the distillation of maximally- 
entangled EPR pairs. However, there are two main differences between these two EDP 
schemes. The first is how the bit error syndrome of a target EPR pair in a bilateral XOR 
operation is learned. In Gotttesman-Lo EDP, Alice and Bob simply measure the target EPR 
pair in the Z basis and compare their results to learn the bit error syndrome (see Figure P). 
In the recurrence scheme, Alice and Bob group the bit error syndromes of all target EPR 
pairs together and learn all the syndromes using random hashing. The second difference 
is that the recurrence scheme requires some extra maximally-entangled EPR pairs to begin 
with for learning the bit error syndromes, whereas no such extra pairs are required in the 



Gotttesman-Lo 



papers, such as [7, 



jDP. We note that the recurrence methods have been studied in various 



m 



Mm- 



The steps for the recurrence protocol are as follows: 

1. Alice and Bob perform BXOR using two noisy EPR pairs as the sources and one 
perfect maximally-entangled EPR pair as the target. 



2. They do random hashing on the target EPR pairs to learn the parities of noisy EPR 
pairs. Note that only a portion of the target EPR pairs have to be measured in order 
to learn all the parities. This is different from the B step approach. 

3. They do error correction and privacy amplification separately for even-parity EPR 
pairs and odd-parity EPR pairs. 

The key generation rate using the recurrence EDP with a single-photon source is given 
by 



R = q 



CxT 



-Ih,{ps)-1-Psh/-^) + K 
2 2 ps 



(9) 



where q is defined similarly as in Eq.®, ps (given in Eq. ()A2jl ) is the probability of getting 
even parity, and S^{S^) is the bit error rate of the control (target) EPR pair. Here, the first 
term in the bracket corresponds to the extra perfect EPR pairs borrowed, the second term 
corresponds to error correction, and the third term K (given in Eq. ()A12|) ) corresponds to 
privacy amplification. In Appendix ^ we review the recurrence EDP in detail and develop 
the key rate formula. 

III. REVIEW OF REALISTIC QKD 

In this section, we set up a model for realistic QKD, and review the idea of GLLP and 
decoy-state QKD. 

A. Realistic QKD setup 

In this section, we present a commonly used fiber-based QKD system model. All later 
simulations of QKD are based on this model. In order to describe a real-world QKD system, 
we need to model the source, transmission and detection. Here we consider a widely used 
QKD setup model with polarization coding j^^, see also |2fil ]. 

Source: The laser source used in the QKD experiment can be modeled as a weak coherent 
state. Assuming that the phase of each pulse is totally randomized, the photon number of 
each pulse follows a Poisson distribution with a parameter /i as its expected photon number 
set by Alice. Thus, the density matrix of the state emitted by Alice is given by 



oo 
PA 



E|^~'i^)(^i' (10) 

j=0 
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where |0)(0| is vacuum state and \i){i\ is the density matrix of the i-photon state for i = 
1, 2 ■ ■ ■ . The states with only one photon {i = 1) are normally called single photon states. 
The states with more than one photon (i > 2), on the other hand, are called -multi photon 
states. Here, we assume Eve receives all the pulses sent by Alice. Eve performs some 
arbitrary operations and sends either a vacuum or a qubit to Bob. This is the squash 

n 

operation introduced in GLLP [22]. Consequently, we denote the qubits coming from these 
three states as vacuum qubits, single photon qubits and multi photon qubits. 

A vacuum qubit is a qubit sent by Eve when Alice sent a vacuum state. (In the case 
without Eve's presence, it is some random qubit stemmed from the dark counts of Bob's 



detector or other background contributions.) Thus, it does not contri 



35, 



36, 



m 



Dute to the key gener- 



38|, multi photon states 



ation. Due to photon-number splitting (PNS) attacks 
are not secure for the BB84 protocol. Here is a key observation of this QKD model: the final 
secure key can only be extracted from single photon qubitsj5^ . Besides BB84, this is true 
for most present QKD protocols, such as E91 J22|, B92 |40| and the six-state J4l| scheme. 
One exception is the SARG04 protocol 4^ , in which two-photon states can also contribute 



to the secure key generation rate 43L l44 1 . 



Transmission: For optical fiber based QKD systems, the losses in the quantum channel 
can be derived from the loss coefficient a measured in dB/km and the length of the fiber I 
in km. The overall transmittance is given by 



Cll 



V = VBobW 10. (11) 

where rjBob denotes for the transmittance in Bob's side, including the internal transmittance 
of optical components and detector efficiency. Here we assume a threshold single photon 
detector on Bob's side. That is to say, we assume that Bob's detector can tell whether there 
is a click or not. However, it cannot tell the actual photon number of the received signal, if 
it contains at least one photon. 

It is reasonable to assume independence between the behaviors of the i photons in i- 
photon states. Therefore the transmittance of i-photon state r]i with respect to a threshold 
detector is given by 

r/, = 1 - (1 - vY (12) 

for z = 0,1,2, ■■•. 



11 



Yield: Define Yi to be tlie yield of an i-photon state, i.e., the conditional probability of a 
detection event at Bob's side given that Alice sends out an z-photon state. Note that Yq is the 
background rate which includes detector dark counts and other background contributions 
such as the stray light from timing pulses. 

The yield of the i-photon states Y^ mainly comes from two parts, the background and 
the true signal. Assuming that the background counts are independent of the signal photon 
detection, then Yi is given by 

Yi = Yo + r]i- Yorji 

(13) 
= Yo + r]i. 

Here we assume Yq (typically 10~^) and rj (typically 10^'^) are small. 
The gain of z-photon states Qi is given by 

Q^ = Y^e-^. (14) 

The gain Qi is the product of the probability of Alice sending out an i-photon state (fol- 
lows Poisson distribution) and the conditional probability of Alice's i-photon state (and 
background) that will lead to a detection event in Bob's detector. 

Quantum Bit Error Rate (QBER): The error rate of i-photon states Cj is given by 

eoYo + CdVi 



Y 



(15) 



where e^ is the probability that a photon hit the erroneous detector, e^ characterizes the 
alignment and stability of the optical system. Experimentally, even at distances as long as 
120km, Cd is independent of the distance jl^j. In what follows, we will also assume that e^ 
is independent of the transmission distance We will assume that the background is random. 
Thus the error rate of the background is Cq = |. Note that Eqs. (fT^ . (|T!?|) . (fT^ and (fTKjl 
are satisfied for alH = 0, 1, 2, ■ ■ ■ . 



The overall gain is given by 



The overall QBER is given by 






1=0 
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Without Eve, a normal QKD transmission will give 



Q. = Yo + l-e 



-r]fi 



(18) 



E^Q^ = eoFo + ed(l - e"'"^ 



B. GLLP idea 

We review the idea of GLLP's |22'| briefly here. GLLP gives a security proof of BB84 
QKD when imperfect devices (such as imperfect single photon sources) are used. There are 
two kind of qubits discussed in GLLP, tagged qubits and untagged qubits. Tagged qubits 
are those that have their basis information revealed to Eve, i.e. tagged qubits are not secure 
for QKD. On the other hand, untagged qubits are secure for QKD. In BB84, qubits coming 
from single-photon states are untagged while those from mu lti-p hoton states are tagged 



rom mu iti-p 

aiy, y,i 



35l l36l . I37l l38| to the multi-photon 



because Eve, for instance, can perform PNS attacks 

states to acquire their basis information. The essential idea of GLLP is that Alice and Bob 

can apply privacy amplification to tagged and untagged qubits separately. Note that the 



idea of tagged state was (perhaps implicitly) introduced by J21|. 

The data post-processing of GLLP is performed as follows. First, Alice and Bob apply 
error correction to all qubits, sacrificing a fraction H2{S) of the key, which is represented in 
the first term of Eq. (jT^. Secondly, in principle, Alice and Bob can distinguish the tagged 
and untagged qubits, so they can apply the privacy amplification on the tagged state and 
untagged state separately. One can imagine executing privacy amplification on two different 
strings, the qubits Stagged and Suntagged arising from the tagged qubits and the untagged qubits 
respectively. Since the privacy amplification is linear (the private key can be computed by 
applying the C2 parity check matrix to the qubit string), the key obtained is the bitwise 
XOR 

•^untagged vb ^tagged 

I 1 

of keys that could be obtained from the tagged and untagged qubits separately [22] . If 
Suntagged IS private and random, then it doesn't matter if Eve knows anything about Stagged — 
the sum will be still private and random. Thus, one only needs to apply privacy amplification 
to the untagged bits alone. 

We define the residue of data post-processing to be the ratio of the final key length to the 
sifted key length (in an asymptotic sense). The residue of this data post-processing scheme 

13 



is given by 

rcLLP = max{-f{S)H2{6) + fi[l - H2{6p)],0} (19) 

where 6 is the overall quantum bit error rate (QBER), Q is the fraction of untagged qubits 
(f2 = 1 — A, where A is the fraction of tagged qubits defined in GLLP J22|), 6p is the phase 
error rate of the untagged qubits, /(■) is the error correction efficiency as a function of error 
rate 46], normally f{x) > 1 with Shannon limit f{x) = 1, and H2{x) is binary entropy 
function. 

We can further extend GLLP's idea to the case of more than two classes of qubits, i.e. 
several kinds of qubits with flag g, which generalizes the concept of tagged and untagged 
qubits. The procedure of data post-processing is similar, do the overall error correction first 
and then apply the privacy amplification to each case. So the privacy amplification part can 
be written as 

J2^'H,{S',) (20) 

9 

where one needs to sum over all cases with fiag g, Qg is the probability of the case with fiag 
g and ^ Q^ = 1, and 6^ is the phase error rate of the state with fiag g. At last, the residue 
of data post-processing is given by 

r = m^x{-f{S)H2{S) + J] fill - H,{5^^)], 0}. (21) 

9 

Apply the QKD model described in Section 1111 Al here, S = E^ and the key generation 
rate is given by 

R = q-Q^-r, (22) 

where Q^ and Efj_ is the gain and QBER of the signal state, and q is defined similarly as in 
Eq.®. 

C. Decoy states 

For BB84, the single photon state is the only source of final secure keys, i.e. the untagged 
qubits come from single photon qubits. So the fraction and error rate of untagged qubit are 
given by 

5p = ei, 
14 



where Qi is given in Eq. (dH), ei is given by Eq. (fT3j). and Q^ is given by Eq. (jT^. By 
substituting Eq. (fTUj). we can rewrite Eq. (j^ into 

R = q-r-Q^ 

(24) 

> g ■ {-Q,f{E,)H2{E,) + Qi[l- i/2(ei)]}, 



which is given in Eq. (11) of 

Q^ and E^ can be measured directly from experiment. The question is how to estimate 
Qi and ei accurately? In principle, Eve can perform non-demolition photon number mea- 
surement on the qubits and she may change the yields (Fj in Subsection IIIIA|) of the qubits 
depending on the measurement outcomes. That is, the yields of qubits, in general, may 
depend on the photon number. Moreover, Eve can adjust the error rates as she wishes. 

The key idea of decoy states is that, instead of just using one coherent state for key 
transmission, Alice and Bob choose some decoy states with different expected photon num- 
bers (/i in Subsection IIII A|) to test the channel transmittance and error rate. We emphasize 
here that decoy states have exactly the same properties other than average photon numbers, 
so that there is no way for Eve to discriminate between the signal states and decoy states 
before Alice publicly announce them. Consequently, we have Yi{decoy) = Yi{signal) and 
ei{decoy) = ei{signal). 

Specifically, the overall gain and the overall QBER in Eq. p6|) and Eq. ()17|) can be 
estimated for a fixed /i in the experiment by Alice and Bob. By changing fi over many 
values, a set of linear equations in the form of Eq. (fT^ and Eq. (fTTj) with unknowns Yi's and 
Cj's are obtained. Thus, Alice and Bob can easily solve for Yi's and e^'s from these equations. 
For BB84, they are only interested in Yi and ei. With the decoy state, Alice and Bob can 
estimate the yields and error rates of single photon states (Y^ and ei) accurately. 

Here we will briefly review the results of decoy state protocols. Details can be seen in 

in n 

I and [26[. In the asymptotic decoy states case [25|, we assume that infinite decoy states 
are employed by Alice and Bob, so they can solve the infinite number of linear equations 
in the form of Eq. (fTB|) and Eq. (fTTj) to get all values of {Yj} and {cj} accurately. In the 
simulation, we will simply take the value of Eq. (fT!?|l and Eq. (fTH|) directly. 

In the practical case, Alice and Bob only need to use two decoy states, a vacuum and 
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weak decoy state. Then they can bound Yi and ei by (Eq. (34) and Eq. (37) in [26 

Yi > -J^iQ^e'' - Q,e>'^ - ^^—^Yo) 

^ E^Q^e^ - eoFo ^ ^ 

ei < 77 , 

Yiu 

where p is the expected photon number of weak decoy state. We remark that when z/ ^ 0, 

Eqs. (P^ will asymptotically approach Eq. (jT^ and Eq. (fT3j). 



IV. BOUNDS 

In QKD experiments, we are interested in maximizing three quantities - the tolerable 
error rates, the key generation rate and the maximal secure distance. In this section, we 
will give out these three bounds due to QKD setup model discussed in Subsection IIII Al 

A. Bounds of error rates 

Here, we will consider the bounds of error rates (bit error rate 6b and phase error rate 
6p), assuming a laser source that emits a fixed number of photons in each pulse (e.g. a basis- 
dependent single-photon source). The upper bounds can be derived by considering some 
simple attacks (such as intercept-resend attack) and determining the QBER caused by these 
attacks. The lower bounds can be determined by the unconditionally security proof assuming 
that Eve is performing arbitrary attack allowed by the law of quantum mechanics and Alice 
and Bob employ some special data post-processing schemes (such as Gottesman-Lo EDP 
described in Subsection III A|l . One lower bound, obtained by considering Gottesman-Lo 
EDP, is 18.9% 8|. For BB84, an upper bound, obtained by considering an intercept-resend 
attack, is 25%. 

Here, we consider the lower bound in a general setting that the error rates are charac- 
terized by {6b, Sp). In general, the bit error rate 6b can be measured by error testing, but 
the phase error rate 6p cannot be directly observed from the QKD experiment. In order to 
guarantee the security, Alice and Bob have to bound 6p with the knowledge of 6b. For BB84 
with an ideal single-photon source, due to the symmetry between the X and Z bases, one 
can show that the bit error rate and the phase error rate are the same, i.e. 

6b = Sp. (26) 
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In general, for other protocols or with non-ideal sources (including coherent sources), the 
bit and phase error rates are different. For example, even for BB84, when a basis-dependent 
source is used, Eq. (flE^ may not hold. In this case, according to the idea of [32], we can 
show that 6b and 6p have the relation of 



i^ < ^(1 - Sb){l - Sp) + v^, (27) 

where F is the fidelity between the two states sent by Alice corresponding to the two bases 
and is the single parameter that characterizes the basis dependency of the source. Thus, 
Alice and Bob can upper bound 6p (denoted as 6p) with this inequality given 6h- Clearly, 
when 6p = 6b, the inequality will be always satisfied, i.e., 6p = 6b is a particular solution of 
Eq. (|7fj). Therefore, in general we have 6p > 6p. In the following, we use 6p to denote the 
upper bound 6p for simplicity. 

Given a QKD protocol and a laser source, Alice and Bob can estimate the phase error 
rate 6p from the bit error rate 6b according to the protocol and the source. We investigate 
the highest error rates that a data post-processing scheme can tolerate. Fig. |21 shows the 
tolerable error rates of the Gottesman-Lo EDP compared to the 1-LOCC EDP scheme, 
illustrating the superior performance of the Gottesman-Lo EDP over the 1-LOCC EDP. 
The boundaries of error rates are found by searching through the regime of 

6b< 6p 

(28) 

6b + 6p< 1/2 

such that positive key rates are obtained. The reason we are interested in the region specified 
the second inequality in Eq. ()28|1 is as follows: We can assume that the error rates 6b and 6p 
are less than 1/2, otherwise Alice and Bob can flip the qubits. Also, if 6b + 6p > 1/2, then 
all the diagonal elements of the density matrix in Eq. (Q) Alice and Bob share are no greater 
than 1/2 (by setting qu = 0). Thus, the diagonalized density matrix is separable J33| and 
the Gottesman-Lo EDP cannot distill any pure EPR pairs. 

The input to the Gottesman-Lo EDP is (goo, Q'lo, Q'li, ?oi) with goo + ?io + Qu + Q'oi = 1, 
see in Subsection III Al But Alice and Bob only know 6b = gio + gii and 6p = gn + goi from 
their error test. There is one free parameter qu. In Appendix C of [8], the authors have 
proved that qu = is the worst case when 6b = 6p. Following that proof, we can show that 
gii = is the worst case when the condition of Eq. (PHj) is satisfied. That is, given {6b, 6p), if 
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4l| and the 



we check the input {1 — Sb — Sp, Sb, 0, Sp) for Gottesman-Lo EDP and get a positive key rate, 
then we can safely claim that Gottesman-Lo EDP can tolerate the error rates of {6b, Sp). 

To determine the tolerable bit error rate of a particular protocol, one should first obtain 
the relationship between the bit error rate and the phase error rate, and plot it on FIG. |21 
The intersections between this curve and the boundary curves (the 1-LOCC curve and 
the Gottesman-Lo curve) indicate the tolerable QBER for the corresponding EDPs. For 
example, for the BB84 protocol with a perfect single-photon source, we have 6b = Sp, which 
is the dashed line plotted in FIG. |21 We can immediately read off from the figure that an 
initial bit error rate of 18.9% is tolerable using the Gottesman-Lo EDP 8], while a error 
rate of 11.0% is tolerable using the 1-LOCC EDP. In general, the Gottesman-Lo EDP gives 
rise to higher tolerable error rates than the 1-LOCC EDP does. 

For protocols having constraints on qn, such as the six-state protocol 
SARG04 protocol with a single- photon source J42, |43|, |4j|, the tolerable QBER can go 
beyond the boundary curves shown in FIG.|2l 

We wrote a computer program to exhaustively search for the optimal B/P sequence up 
to 12 steps. The precision of the program is 10~^^. 

B. Distance upper bound 

Let us come back to the realistic QKD setup model discussed in Subsection IIII Al An 
upper bound on the bit error rate of the single photon state is 25%, above which BB84 is 
broken by the intercept-resend attack. The maximal secure distance then can be bounded 
by the distance when the bit error rate of the single photon state reaches 25%. 

The error rate of the single photon state ei is given in (fT^ . 

""'" V + Yo 
where e^ is the intrinsic error rate of the detector in Bob's side, t] is the overall transmittance, 
and Yo is the background rate. Thus, ei exceeds 25% when 

, < ^^^. (29) 

' - 0.25 -ea ^ ^ 

In GYS |l9ys case, the fiber loss is a = 0.21dB/km, e^ = 3.3% and Yo = 1.7 x 10-^ then 
the upper bound of secure distance is 208A;m. 
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FIG. 2: shows the secure regions in terms of error rates for 1-LOCC EDP and Gottesman-Lo EDP. 
The regions under sohd hues are proven to be secure due to 1-LOCC EDP, and Gottesman-Lo EDP 
schemes (for the region under the sohd hne and dashed hne), respectively. For 1-LOCC EDP, we 
use Eq. ^. For Gottesman-Lo EDP, we use Eqs. © and (jT)). In Gottesman-Lo EDP, we optimize 
the B/P sequence up to 12 steps. 

C. Key generation rate upper bound 



According to our model, the final secure key can only be derived from single photon 
qubits. To derive the upper bound of key generation rate, we assume that Alice and Bob 
can distinguish the single photon qubits from other qubits (say, vacuum and multi photon 
qubits). So they can perform the classical data post-processing only on to the single photon 
qubits. One upper bound of key generation rate is given by the mutual information between 
AHce and Bob J45| , 



R"" = Q,[l - H^ie,)], 



(30) 



where Qi is the yields of single photon states and ei is the error rate of single photon states. 

Note that the above two upper bounds, Eqs. (j^ and (jHUj) . assume that a) Alice and Bob 

cannot distinguish background counts and true signal counts and b) secure key can only be 
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extracted from the single photon states. Also, these two bounds are general upper bounds 
regardless of the technique used for combating the effect of imperfect devices such as the 
decoy-state technique. 

V. DECOY + GLLP + GOTTESMAN-LO EDP 

In this section, we propose a new 2-LOCC based data post-processing protocol with a 
form of a sequence of B steps, followed by error correction and privacy amplification, as 
discussed in Subsection IllAI This new scheme is a generalization of the Gottesman-Lo 
scheme to the case of imperfect devices. The reasons why we skip P steps here are as 
follows. First, from the simulation in Subsection IIVAI we found that P steps are not as 
useful as B steps. Secondly, only considering B steps can simplify the procedure of the data 
post-processing scheme. 

The procedure of this data post-processing is as follows. 

1. Alice and Bob perform a sequence of B steps to the sifted keys (corresponding to tb 
in Eq. (jSH)). 

2. They calculate the variables (such as QBER, untagged qubits ratio) after the B steps. 

3. They perform overall error correction (corresponding to the first term in Eq. (jHTjl ). 

4. They perform privacy amplification (corresponding to the second term in Eq. (j31|) ). 

In the following, we will discuss how to calculate the residue of this data post-processing 
scheme. 

In the decoy protocol, there are three kind of qubits: vacuum, single photon and multi 
photon qubits, described in Section QllAI We emphasize again here that the final secure key 
can only be distilled from untagged qubits (single photon qubits). 

Since either of the two inputs of a B step has three possibilities, the outcomes of a B 
step then have nine possibilities. Only the case that both inputs are untagged qubits has 
positive contribution to the final secure key and all other privacy amplification terms in 
Eq. (J2H) will be 0. That is, at the end of some B steps and bit error correction, privacy 
amplification can be only applied to the remaining qubits that come from the case where 
both inputs are untagged qubits. In other words, an output qubit after a subsequence of B 

20 



steps is "untagged" iff a) it passes all B steps and b) it is generated from the case where 
all initial input qubits are single photon qubits. Therefore, the residue ratio of data post 
processing can be expressed, according to Eq. (|^. as 

r = max{fB[-fiS)H2i6)+^il ' ^^2(^7*'^^^^"))], 0} (31) 

where 5 is the overall QBER, f^ is overall survival residue, Q is the fraction of untagged 
states in the final survival states and ^^"■^"■aaed. jg ^]-^g phase error rate of the untagged states, 
after a sequence of B steps. In the following, we will show how these variables change with 
performing B steps. 

An arbitrary B step: B step is an important two-way primitive that we will use in this 
paper. Let us consider how the various quantities (fraction of untagged states Q, QBER of 
overall surviving states 6, bit error rate Suntagged and phase error rates 6p of the untagged 
states) are transformed under one step in a B step sequence. 

Before a B step, the fraction of untagged states is Q, the overall QBER is 6, the bit error 
rate of the untagged states is Suntagged, and the phase error rate of the untagged states is 6p. 
According to Eq. Q the overall survival probability ps and the survival probability of the 
untagged states p^"*"^^^ after one B step are given by 

untagged rr2 _L H A \'^] 

Ps ~ ["untagged + U ~ ^untagged) J- 

Then the residue after one B step is given by, 

rs = ^Ps (33) 

The factor ^ in Eq. (jH^ due to the fact that Alice and Bob only keep one qubit from a 
survival pair. Then, after a B step the fraction of untagged states Q' is given by 

q2 untagged 

Q' = ^-^—^ . (34) 

Ps 

Overall QBER: the change of overall QBER 6' is given by 

^' = 6^ + ii-6r ^^'^ 

Untagged states: before the first round of B step, the initial density matrix of untagged 
state is (1 — 2ei + qn, ei — qn, qu, ei — qu), where ei is the error rate of single photon states. 
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From Appendix C of J8[, we know that qu = is the worst case for B steps. Thus we can 
conservatively choose (1 — 2ei,ei,0,ei) as the initial input density matrix. If only B steps 
are performed, gn = will always be satisfied, according to Eq. (0). So the input untagged 
qubits for any round of B step has the form of 



[Qoo, Qw, ?ii) Qoi) 



S: 



untagged 



"p; (Juntaggedi 



0,<5p). 



(36) 



The bit error rate of untagged state S'^ntagged o^ly depends on the input Suntagged, 



untagged 



'^untagged ~ r2 _|_ H — A 

"untagged ~^ \^ "u 

According to Eqs. (0), (0) and (jHUj) . the phase error rate of untagged states is 

5p = Qn + Qoi 

_ 2giogii + 2googoi 

(gio + qiiY + (goo + qQi? 

^Op ' \^ ^untagged "pj 



(37) 



(38) 



^untagged + 1"'- "u 



2' 



Eqs. ()32|) - ()38p are valid for a general B step. Alice and Bob can perform a sequence 
of B steps as described above and then do the error correction and privacy amplification. 
Once all the these quantities are obtained, the key generation rate can be calculated from 
Eq. dSD). 

To illustrate the improvement made by introducing B steps, we numerically calculated 
the key generation rate assuming the parameters in the GYS experiment [l9J. Note that 
the overall QBER 5 in Eq. (jM]) never exceeds 10%. The value of /(e) = 1.22 is the upper 
bound according to [46] . The parameters used for simulation are listed in Table EJ 



Wavelength [nm] 


a [dB/km] 


VBob 


e-d 


lo 


1550 


0.21 


4.5% 


3.3% 


1.7 X 10"^ 



TABLE I: Data come from GYS 



EI 



From FIG. El we can see that there is a non-trivial extension of maximal secure distance 
after introducing B steps. We remark that the key generation rate decoy state protocol 
with 1 B step is higher than the one with 1-LOCC from the distance around 132km. The 
maximal secure distance using 4 B steps is ISlfcm, which is not far from the upper bound 
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of 208km, given in Section IIVBI Even with only one B step, the maximal secure distance 
can be extended from 142km to 162km. Thus, B steps are very useful in QKD data post- 
processing. 
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FIG. 3: shows the key generation rate as a function of the transmission distance with the data 
post-proces sing scheme of the GLLP-|-Decoy-|-B steps. The parameters used are from the GYS 



experiment 
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at distance of 132km. The maximal secure distance using 4 B steps is 181km, which is not far 
from the upper bound of 208km. 



VI. DECOY + GLLP + RECURRENCE EDP 

In this section, we propose a second 2-LOCC based data post-processing scheme based 
on the recurrence scheme |li|, which is reviewed in Subsection III Bl Our scheme is a gener- 
alization of the recurrence scheme to the case of imperfect sources. 

In Section Fill Bl we give out a formula, Eq. ()21|). for key generation rate with the idea of 
GLLP. Let us combine recurrence with Eq. (PT|) . So, instead of just taking care of one kind 
of qubit, we need to apply privacy amplification to several groups of qubits separately, i.e.. 
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we will have several Ki in Eq. ()A6|) . After the recurrence, the data post-processing residue 
rate becomes 

r = -y(ps)H,{ps) - lpsf{f)HA + J]fi.ir„ (39) 

^ ^ Ps Ps ^ 

where ps is the even parity possibility given in Eq. ()A2j) with 5^ = 5"^ = 5, 5 is the 
overall QBER before the recurrence, /(■) is error correction efficiency, fij and K^ are the 
probability and the residue of the qubit groups with label i after privacy amplification, 
respectively. Here, Alice and Bob first check the parity, corresponding to the first term 
of Eq. (jnni)- Secondly, they apply overall error correction to the qubits with even parity, 
corresponding to the second term of Eq. ()H9j) . Thirdly, they measure one of qubits in those 
pairs with odd parity to obtain the error syndrome of another qubit. Afterwards, they can 
group the surviving qubits into several groups with labels i. Finally, they perform privacy 
amplification to each group with label z, corresponding to the last term of Eq. ()39|) . 

Consider the decoy state case, Alice and Bob have three kinds of input qubits: vacuum 
qubits (V), single photons qubit (S) and multi photon qubits (M). The input parameters for 
recurrence are listed in Table ITTl 



Qubit 


Fraction 


h 


5, 


911 


V 


^v 


1/2 


1/2 


'Zfi 


S 


n 


ei 


ei 


a 


M 


^M 


CM 


1/2 


M 
9ii 



TABLE II: lists the input parameters of three kinds of qubits for recurrence. Following Eq. H14|) 
and ((ro|) . the fractions of each group are given by Oy = Qo/Q^, ^ = Qi/Qi_i and JIm = 1 — Cly — ^• 
Oy/2 + eiil + cm^m = (5 is the overall QBER. 

Thus, the outcome of one round of recurrence will have nine cases. Clearly, if neither 
input is a single photon qubits, the outcome will have no contribution to the final key. Alice 
and Bob need only apply Eq. ()A12|) to calculate the residues, K^, for the five cases: V 1^ S, 
S ^V, S (^ S, 5 M, M ^ S. The probabilities of occurrence, Qi, for the five cases are, 
respectively, Qy^, QQy, ^^j ^^m, ^a/^- Once we know Ki and Qi, we can then determine 
the overall residue, r, using Eq. (jH^ (details are shown in Appendix IH]): 



r>-B + C-F^ 



(40) 
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where 



B = \f{ps)H2{ps) + \psf{-)H2{-) 
^ ^ Ps Ps 

C = jQv^ + ^^(1 - ei + el) + -QQm{2 - ei 



Cm + ^eicu] 



(41) 



Do 



-fiyfi + -n\l + ei) + -n^MieM + 1) 



F„ = Z}i(l-ei)i72 



+D2eiif2 - 

1 - ei ei 



with equahty when g}^ = 1/4 and gff = Cm/S. In order to get a lower bound of key 
generation rate R, we maximize Fa over a by using a bisection method as discussed in 
Appendix |B| 
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FIG. 4: Plot of the key generation rate as a function of the transmission distance, 
GLLP+Decoy+Recurrence vs. GLLP+Decoy+1-LOCC. Recurrence does have some marginal im- 
provement over 1-LOCC for short distances. In particular, the recurrence method increases the 
key generation rate by more than 10% in our simulation. The maximal secure distance for each 
case is 142.8km (1-LOCC), 149.1km (Recurrence), 163.8km (IB), respectively. Here we consider 

the asymptotic Decoy state QKD case with infinitely long signals. The parameters used are from 

) — i 

the GYS experiment ,13] listed in Table Q] 
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Figure E] shows the key generation rate as a function of the transmission distance for 
GLLP+Decoy+1-LOCC, GLLP+Decoy+IB, and GLLP+Decoy+Recurrence. Recurrence 
does have some marginal improvement (more than 10%) in the key generation rate over 
1-LOCC for short distances, and it also increases the maximal secure distance by 6km. We 
remark that recurrence is useful even in the short distance regime. 

VII. STATISTICAL FLUCTUATIONS 

In a realistic QKD experiment, only a finite number of signals are transmitted. Thus, the 
estimations of Yi and ei have certain statistical fluctuations. These statistical fluctuations 
in decoy state QKD with 1-LOCC are analyzed in j2g], and also 27 1. In this section, we will 
consider statistical fluctuations for two data post-processing schemes with 2-LOCC discussed 
in Section \V\ and Section IVIl Following the analysis in |26|, we can easily incorporate 
statistical fluctuations in these two data post-processing schemes. 

In J2q, Qi and ei are bounded when taking statistical fluctuations into account. As for 
the post-processing with 2-LOCC described in Section El the inputs of the B steps are Q^, 
Efj_, which can be measured directly from experiment, and Qi, ei, which are estimated by 
the decoy method. Evidently, one should take the lower bound of Qi and the upper bound of 
Ci to lower bound the key rate R. Thus the procedure will be as follows, first with the decoy 
method, one can lower bound Qi and upper bound ei, and then input the four parameters 
{Qfj,, E^, Qi and ei) into the data post-processing of GLLP-|-Decoy+B step to extract secure 
keys. 

As for the case of recurrence, from Table m Alice and Bob have to estimate Qo besides 
the four parameters discussed above. From Eq. ()40|) . it is not clear which bounds of Qq 
one should pick up to lower-bound the key rate. One can clearly see that lower-bounding 
Eq. fl4()j) is a hard problem. Instead of going to tedious mathematical calculations here, we 
have a plausible argument based on our physical intuition. First of all, single photon qubits 
are "good" qubits in our discussion. So, we reasonably assume that Ahce and Bob can 
safely use the lower bound of Qi and the upper bound of ei to lower bound the key rate. 
As discussed in [51], the vacuum decoy state can have positive contribution in the privacy 
amplification procedure. Also, in the Appendix of |2||], we have proven that one should take 
the lower bound of Yq to lower bound the key generation rate in 1-LOCC case. Thus, here 
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we take the lower bound of Qq to estimate the key rate. 

The results are shown in Figure El Here, we assume Alice and Bob use 6 x 10^ number 
of pulses. These pulses are randomly selected as signal and decoy states. The distribution, 
among the signal states, vacuum states and weak decoy states, was found by an exhaustive 
search for the optimal one. Then, we use 10 standard deviations to bound Qi/, E^ and Yq, 
and substitute the worst-case values of these into 



Qi>Q\ 



L,iy,0 



ei < e^ 



U,u,0 






(42) 



yi 



L,iy,0 



to bound Qi and ci. Here, u is the expected photon number of the weak decoy states, Qi, 
and El, are the gain and QBER of the weak decoy states. We can see that with statistical 
fluctuations, the improvements of 2-LOCC are still notable. 
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FIG. 5: shows the simulation results for three data post-processing schemes of the decoy state 
protocol, Decoy-I- 1-LOCC, Decoy-|-l B and Decoy-|- Recurrence, considering statistical fluctuations. 
The maximal secure distances of three schemes are 120km, 125km and 147km, respectively. The 
parameters used are from the GYS experiment [l9| listed in Tabled 
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VIII. CONCLUSION 

We have developed two data post-processing schemes for decoy-state QKD using 2-LOCC, 
one based on B steps and the other one based on the recurrence method. The distance 
of secure QKD is crucial in practical applications. Therefore, our Decoy-|-B steps post- 
processing protocol, which we have shown to be able to increase the maximal secure distance 
of QKD from about 141 km to about 182 km (using parameters from the GYS experiment 
[19|), proves useful in real-life applications. Moreover, our work shows that recurrence 
protocols are useful for increasing the key generation rate in a practical QKD system even 
at short distances. While we have focused our modeling on a fiber-based QKD system, our 
general formalism applies also to open-air QKD systems. 

We have shown that similar conclusions hold even with statistical fluctuations in the 
experimental variables for the Decoy+B step scheme. For the Decoy-|-Recurrence scheme, 
although we do not have a rigorous argument, physical intuition suggests that similar con- 
clusions hold with statistical fluctuations as well. We conclude that using two-way classical 
communications is superior to using one-way for our decoy-state QKD schemes. 

In addition, we provided the region of bit error rates and phase error rates that are 
tolerable by using the Gottesman-Lo EDP scheme. Also, we calculated the upper bounds 
on distance and on the key generation rate of a real QKD setup based on our model. 
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APPENDIX A: KEY RATE OF THE RECURRENCE SCHEME WITH AN 
IDEAL SOURCE 

In this section, we review the recurrence EDP and develop the key generation rate formula 
given by 

R = q-r, (Al) 
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where q depends on the implementation of the QKD (1/2 for the BB84 protocol, because 
half the time Alice and Bob bases are not compatible) and r is the residue which we will find 
in the sequel. In the following, we use the same notation as in Subsection [H] and consider a 
Bell diagonal state (goo, ^lo, ^ii, ^oi)- 

a. Parity check 

As the first step of recurrence, Alice and Bob check the parity of two pairs (labeled by 
control qubit C and target qubit T). They will get even parity if the two pairs are in one of 
the states 

0000, 0001, 0100, 0101, 1010, 1011, 1110, 1111, 

and will get odd parity if they are in one of the states 

0010, 0011, 0110, 0111, 1000, 1001, 1100, 1101, 

where the first two bits represent the control qubit, and the last two bits represent the target 
qubit. For example, 1110 means that there is a bit error and a phase error in the control 
qubit, and a bit error and no phase error in the target qubit. Thus, the probability to get 
even parity is given by 

A2 
= (l-5f)(l-5n+«, 

where 5^ = <iiQ + Qu and 5^ = gfg + gf^ are the bit error rates of the input control and target 
qubits, respectively. During the parity check, the number of pure EPR pairs that Alice and 
Bob need to sacrifice is given by 

Ih,{ps), (A3) 

where | is due to the fact that Alice and Bob compute the parity of two-qubit pairs at one 
time. 

After the parity check, the qubits are divided into two groups, qubits with even parity and 
odd parity. In the following, we will discuss the error correction and privacy amplification 
on these two groups separately. The recurrence protocol appearing in [li| only performs 
error correction on qubits with even parity. 
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b. Error correction 

For even parity qubits, we can see that the bit error syndrome of control qubits will be 

the same as that of target qubits. Thus, Alice and Bob only need to do error correction on 

the control (or target) qubits. According to Eq. ©, the bit error rate of control qubits after 

recurrence is given by 

^c ^ (9fo + gn)(gfo + gn) ^ C^ (^4) 

^ Ps Ps 

where ps is the probability of even parity in the recurrence given by Eq. ()A2|) . Therefore, 

Alice and Bob need to sacrifice a fraction 

IpsHM) = Ipsh/-^) (A5) 

to do the overall error correction. The factor ^ is due to the fact that control qubits have 
the same error syndrome as target qubits. 

Therefore the residue of data post-processing, similar to Eq. ()19|1 . can be expressed as 



1 1 ^C ^T 

r = --H,{ps) - -psH2{^^^) + K (A6) 

2 2 Ps 

where ps is given in Eq. ()A2|) and K is the residue of privacy amplification, which we will 
focus on in the following. 

c. Privacy amplification 

Alice and Bob perform privacy amplification to the qubits with even and odd parity 
separately. 

Even parity: now, Alice and Bob already know the bit error syndrome. The control 
and target qubits have the same bit error syndromes, but may have different phase error 
syndromes. Thus, Alice and Bob can divide the even parity qubits into four groups: control 
qubits with bit error syndrome and 1, and target qubits with bit error syndrome and 1, 
and treat these groups separately in the privacy amplification step. The probability of each 
group (summing together the even parity probabilities given in Eq. ()A2|) ) is given by 

{<lm + (loi){<im + (lm) (gfo + gfi)(9fo + gn) (9ro + go^i)(9ro + gJi) (gfo + gn)(gfo + gfi) 
2 ' 2 ' 2 ' 2 

with phase error rate 

n n 1^ T^ 

%i ?ii %i Tn 
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Since the error syndrome of each group of qubits is known to Ahce and Bob, privacy am- 
phfication can be apphed to the different groups separately. Then, Ahce and Bob should 
sacrifice a fraction 



;; J^2[-c~, — 7^) H ;; -"21-?^— — 7^) + 



(A7) 



'21 T . ^T ; -^ 5 -"21 r , ^T 



2 %o + %i 2 gio + ?ii 

to do the privacy amplification. Given the bit and phase error rates of input control and 
target qubits 6^ = qf^ + g^ and 6^ = qj^ + q^^, Eq. ()A7|) can be written as 



2 l-Ofo 1-^6 2 6^ 5^ 

Thus the privacy amplification residue of even parity qubits is given by, 

(A9) 

Odd parity: it turns out that pairs with odd parity during the recurrence can also 

contribute to the final key |li|. Instead of including them in the error correction, Alice 

and Bob measure one of the two qubits and hence they know the bit error syndrome of the 

remaining qubit. They can then proceed with privacy amplification on those qubits. 

Suppose Alice and Bob always choose to measure the target qubits and obtain the error 
syndrome of the control qubits. Similar to the even parity case, now, Alice and Bob can 
divide the control qubits with odd parity into two parts according to the bit error syndrome. 
The probability of each part is given by 

{<lm + <im Mo + <lu ) (^fo + ?fi ) (^o'o + Qm ) 



with phase error rate 



Qoo + (Im ' ?fo + (111 ' 



With the same argument as Eq. ()A7|1 . the number of qubits that need be sacrificed to 
privacy amplification is given by 
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(AlO) 



So the privacy amplification residue of odd parity qubits is given by, 



\{l-5^)5l[l-H,{-^^)] + \.,,. .,,, ...r^c. 



KoM = 7^(1 - 6^)6^1 - M^^)] + -6Ul - ^^[1 - H^Cj^)] (All) 



Tlierefore, tlie privacy amplification residue, K in Eq. ()A6|1 . by adding Eq. ()A9j) and 
Eq. (jAllj) and substituting Eq. ()A2jl . is given by 

^ -'^even ' ^odd 

=1 - ^(1 - 5f )5r - ^^f (1 - ^n - \{l - 5f )^2(f^) - \8?H,{^) (A12) 
- ^(1 - 5^(1 - ^n^2(f^) - ^^a^^2(|). 

Note that there are two free parameters g^ and gf^ in Eq. ()A12jl , which should be minimized 
over to obtain the worst-case key rate. 



APPENDIX B: RESIDUE FOR THE DECOY+GLLP+RECURRENCE SCHEME 

We calculate the residues, Ki, in Eq. (jH^ for the five cases: V^S, S ^V , Sl^S, 
S (^ M, M 1^ S. Here, we apply each case, with parameters shown in Table ITTl into Eq. ()A12|) 
to calculate each Ki. 

V ^ S: the probability of this case is Qys = ^v^- 

Xvs = 1 - J - \h,{1 - 2rf;) - \h,(H.) - i(l - e,)ff, (^) - \c,H, (^) 

(Bl) 
with equality when g]^ = 1/4. This is due to the concavity of function H2{-). 
S ^V: the probability of this case is Qys = fiyfi- 

Ksv > 1 1 



;i - e,)H, (^) - l^H, (^) - 1(1 - e,)H, (l - 2grO - \e,H, {2qr,) 



(B2) 
with equality when q\^ = 1/4. 
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S ^ S: the probability of this case is Qyv = ^^- 

S (^ M: the probabihty of this case is Qsm = ^^m 

KsM = 1 - 2^1(1 - ^Af) - 2^aK1 - ei) - -(1 - ei)H2 i -^- — j - 2^i^2 ( — 

-i(l-eO(l-e„)/..(i^)-le,e„ff.(g) (B4) 

with equahty when gjY = cm/S. 

M (3) "S: the probabihty of this case is VLms = ^m^ 

K„s = 1 - ie„(l - eO - ie,(l - e„) - 1(1 - e„)H. (i^) - i.„ff, (^ 

11/ N 1 / 

(B6) 

with equahty when q^^ = Cm/'^- 

n " n 

Therefore, after combining GLLP [22], Decoy ^25], and Recurrence [10[, the data post- 
processing residue rate wiU be given by, substituting Eqs. ()B1|1 . ()B2|) . ()B3|) . ()B4|) and ()B5|) 
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into Eq. ^ . 
1 



r = 



lf{ps)H,{ps) - lpsf{—)H2{—) + Kvs + Ksv + Kss + Ksm + i^^ 
2 2 ps Ps 

>~\f{ps)H,{ps)-\psf{-)H,{-) 

I Z Ps Ps 

„ „ ri 1 ,. , ,. /ei — a\ 1 

+ r2yr2 



MS 



--(l-ei)ff: 



4 4 
1 1 
2 



r3^ri-^^(- 



---(l-e,)ft 






- -,e^H. ( - 



+ ^'[l-ei(l-ei)-^(l- 



ei)H2 



' e\ — a 



- -eiH2 — 



a 
ei. 



(B6) 



-i.2 



'.^'Ht. 



+ nnM[- - 2^m(1 - ei) - -ei(l - CAf) 
1 



-2(l-ei)(l- 



eM)i/.(^)-^e,eMi/J^^ 



with equality when g}^ = 1/4 and gf/ = eAf/2. In order to simphfy this formula, we define 
some variables, 

B = ]-f{ps)H,{ps) + \psf{-)H,{-) 

2 2 Ps Ps 

3 1 

C = -fiyfi + fi^(l - ei + e?) + -fi^Af (2 - ei - cm + 2eieM) 

Di = ^fiyfi + il]2(2 - ei) + ififiA/(2 - CAf) 
Z}2 = l^v^ + \^\l + ei) + ^mA/(eA/ + 1) 
Thus Eq. (Pmi can be expressed as 



(B7) 



r = — 



= - B + Kvs + Ksv + Kss + Ksm + K, 
>-B + C-Fa 



MS 



(B8) 



where 



ei 



(B9) 



1-ei 
with equality when q^i = 1/4 and qf( = eA//2. 

To lower bound r in Eq. ()B8|) . we need to find the maximum value of Fa over the free 
variable a. We are interested in the range of a G [0, ei] with ei < 1/2. Note that F^ 



is 
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a concave function of a in the valid range, since a sum of two concave functions is also a 
concave function, and reflecting and shifting a concave function is also a concave function. 
Thus, we can take the derivative of Fa with respect to a and set it to zero to find the 
maximum of Fa- Differentiating Fa with respect to a gives 



dF, 



a 



da 



Di 



^°s^ < r=^ ) - ^°^^ y-hi 



D, 



log2 [I- — \ - l0g2 ( — 



Setting 2 da = \ gives 



'' iV'U'-^-iT = 1. 



ei — a J \ a 

Denoting the left-hand side to be /(a), /(a) is a decreasing function of a since ^ is a 
decreasing function of a. Therefore, we can use the bisection method to find a such that 
/(a) = 1. The initial range for the bisection method is [0, ei]. 
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